radaradam

Thank's for the help!

Two days later, still all good! From my understanding this was the cause of it all: https://community.ui.com/releases/Security-Advisory-Bulletin-023-023/808a1db0-5f8e-4b91-9097-9822f3f90207 Closed all ports to the container and updated to 6.5.55.

Good to know! So far i have closed all ports in the router and killed the xmrig-process. Sometimes it takes a couple of hours before it starts after it has been killed. I'll let you know how it goes. Thanks in the meantime!

Thanks, will do!

I'm closing all ports right now. I don't need access to them (and if I'm going that route in the future I'll look into VPN). But I guess the damage has already been done, and that I'm atleast has to reinstall the Unifi-container.

Good find! The Unifi-container is from community applications. The Linuxserver.io-version. No extra into it. Yes, i can access it outside the network. All my containers that I have open ports to are accessible otuside the network. I have no need to access the outside the network. So, stupid question - I somehow thougt that i had to open those ports for the container to function.

Hi, A couple of days ago I discovered that my cpu usage was at 100% on all cores. I started to investigating what was wrong but couldn't find anything going on with my dockers or VM. When i ran htop in the terminal i discovered that xmrig was running and using 100% CPU. I understand that this is somkind of software used in mining crypto. And since I'm not doing it, im guessing that someone else is doing it on my server. In other words - I have been hacked. I run the following docker containers: CUPS Deconz Deluge Grafana Influxdb NZBget Plex Radarr Shinobipro Sonarr Unifi-controller VM: Homeassistant All containers are in bridge mode and has a dedicated static IP on my LAN. Homeassistant VM is on it's own VLAN that can't communicate with my LAN. I'm not a pro, but to my understanding I don't have any ports open directly to my server. My Unraid-server is on 192.168.1.5. And this is all my open ports in my router. I have looked through all the logs but i can't find anything suspicious. I woud like to find out how this hacker got in (my guess through some docker container). And how do i stop it? I can kill the process, or restart the server. But xmrig automatically starts up after a couple hours. Thanks in advance! tower-diagnostics-20220108-1653.zip